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of  the  Montana  State  Legislature: 

This  is  our  EDP  audit  report  of  the  Department  of  Public  Health  and  Human  Service's 
internal  controls  relating  to  its  computer-based  System  for  the  Enforcement  And  Recovery  of 
Child  Support  (SEARCHS).   We  reviewed  the  department's  general  controls  as  they  relate  to 
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Report  Summary 


Introduction 


This  is  an  audit  of  internal  controls  over  the  Department  of  Public 
Health  and  Human  Service's  computer-based  System  for  the 
Enforcement  And  Recovery  of  Child  Support  (SEARCHS).   We 
selected  the  Department  of  Public  Health  and  Human  Services 
(DPHHS)  and  this  application  because  of  the  significant  dollar 
amounts  processed  and  the  widespread  use  of  the  information 
maintained  on  the  system.   In  addition,  this  audit  provides 
assistance  to  the  financial-compliance  audit  staff  of  the  Legislative 
Audit  Division  in  their  biennial  audit  of  the  DPHHS. 


Background 


The  Child  Support  Enforcement  Division  (CSED)  of  DPHHS  was 
established  to  aid  in  locating  absent  parents,  and  recovering  child 
support  from  those  parents.   The  SEARCHS  system  provides 
information  to  aid  CSED  personnel  in  locating  absent  parents, 
establishing  paternity  and  support,  and  in  enforcing  the  child 
support  order.   SEARCHS  is  a  complex  and  comprehensive  system 
which  encompasses  all  child  support  enforcement  services  in  the 
state. 


SEARCHS  operates  on  the  Department  of  Administration's 
mainframe  computer.   A  contract  vendor  is  responsible  for 
facilities  management  for  the  system.   Under  this  arrangement,  the 
vendor  is  responsible  for  the  support  of  all  SEARCHS  related 
computer  processing  functions. 


Organization  of  Report 


This  report  is  divided  into  three  chapters.   Chapter  I  contains  the 
introduction  and  background,  Chapter  II  discusses  the  electronic 
access  control  issues,  Chapter  III  discusses  application  control 
issues  which  are  applicable  to  the  various  regions,  and  Chapter  IV 
discusses  issues  related  to  central  operations. 
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Access  Controls 


Access  controls  provide  electronic  safeguards  designed  to  ensure 
computer  system  resources  are  properly  used.   Logon  IDs  and 
passwords  control  electronic  access  to  DPHHS's  computer  applica- 
tions, computer  programs,  and  computer  data.   Federal  regulations 
require  the  state  to  have  policies  to  evaluate  SEARCHS  for  risk  on 
a  periodic  basis.   The  system  must  be  protected  against 
unauthorized  access  to  computer  resources  and  data  in  order  to 
reduce  erroneous  or  fraudulent  activities.   Proper  access  controls 
assist  in  the  prevention  or  detection  of  deliberate  or  accidental 
errors  caused  by  improper  use  or  manipulation  of  data  files, 
unauthorized  or  incorrect  use  of  a  computer  program,  and/or 
improper  use  of  computer  resources.   Assigning  limited  access 
based  on  job  requirements  facilitates  checks  and  balances  in  the 
system.   This  approach  prevents  users  from  inadvertently  or  will- 
fully executing  programs  or  changing  data  unrelated  to  their  job. 
This  report  discusses  several  areas  where  the  department  could 
improve  its  access  controls. 


Access  to  Production  Files 
Should  be  Restricted 


We  reviewed  electronic  access  rights  given  for  the  SEARCHS 
programs  and  data  within  the  production  system.   The  department 
has  granted  full  (read,  write,  allocate,  execute)  privileges  to  several 
contract  programmers  and  agency  personnel.   In  addition,  three 
IDs  with  generic  "operator"  names  also  have  total  write  access  to 
the  production  files  and  programs. 


Access  to  production  files  should  be  limited  to  those  authorized  to 
process  or  maintain  particular  systems  based  on  the  job  duties  of 
the  individual.   Ideally,  write  access  to  production  files  should  be 
limited  to  the  person  performing  a  particular  job,  and  only  for  the 
time  period  needed  to  complete  the  job.   A  person  with  unrestricted 
access  could  modify  the  existing  programs  and/or  data  without 
authorization  and  potentially  manipulate  the  system. 
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System  Table  Access 
Should  be  Restricted 


Twenty-eight  individuals  have  write  access  to  system  tables  which 
contain  key  data  used  in  other  processes.   Nine  of  the  twenty-eight 
individuals  are  CSED  employees  who  are  not  responsible  for 
maintaining  the  system  tables.   Seventeen  of  the  twenty-eight  are 
contract  employees  whose  duties  periodically  include  updating 
system  tables  upon  department  request.   The  remaining  two 
employees  are  primarily  responsible  for  table  maintenance. 


Effective  electronic  access  controls  over  system  tables  should 
prevent  unauthorized  employees  from  changing  table  information 
either  intentionally  or  unintentionally.   Improperly  updated  table 
information  could  result  in  inaccurate  computation  of  child  support 
obligations.   The  access  to  the  system  tables  should  be  reviewed, 
and  inappropriate  access  presently  granted  to  individuals  should  be 
revoked. 


Caseworker  Access  to 
Accounting  Screens 
Should  be  Restricted 


When  a  new  child  support  case  is  created,  the  initial  accounting 
information  (support  order  amount,  payment  history,  etc.)  is 
entered  by  the  caseworkers.   The  caseworker  then  has  the  ability  to 
update  or  change  the  accounting  information  on  that  account,  but 
only  for  that  day.   After  that,  the  caseworkers  are  locked  out  of  all 
of  the  accounting  screens,  except  for  the  Debt  Order  History 
(DOH)  screen.   Caseworkers  may  change  the  information  on  the 
DOH  screen  at  any  time. 


The  DOH  screen  is  used  to  print  the  Debt  Comp  History  report, 
which  is  distributed  to  the  CSED  clients  and  documents  the  legal 
obligation  of  the  absent  parent.   Therefore,  it  is  imperative  the 
information  on  the  report  be  accurate.   This  is  difficult  to  ensure, 
since  the  information  can  be  changed  by  caseworkers  at  any  time, 
with  or  without  supporting  documentation.   We  believe  the 
department  should  either  restrict  access  for  the  accounting  screens 
to  only  those  individuals  trained  to  perform  those  tasks  or  establish 
other  controls  to  ensure  the  DOH  screen  agrees  to  the  other 
accounting  screens. 
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Position  Codes  do  not 
Agree  with  Actual  Job 
Duties 


As  additional  protection  against  unauthorized  access  to  the 
SEARCHS  system  information,  there  is  additional  security  beyond 
the  ACF2  security  provided  by  the  mainframe.    This  security 
system  allows  or  restricts  access  to  particular  screens  and  fields 
within  those  screens.   Rather  than  creating  a  specific  access  matrix 
for  each  individual  user,  department  personnel  identified  40 
positions  within  the  department,  and,  for  access  purposes, 
individuals  are  assigned  to  one  of  those  40  positions.   The 
department  should  reevaluate  the  assigned  position  codes  to  ensure 
the  access  allowed  aligns  with  the  individual's  job  duties. 


Of  51  users  we  tested,  13  users  were  assigned  position  codes  that 
were  inconsistent  with  their  actual  job  duties.   Improperly  assigned 
position  codes  could  allow  employees  access  to  data  and  processes 
that  is  inappropriate  for  their  position. 


Regional  Office  Issues 


Introduction 


The  SEARCHS  system  provides  some  "tools"  to  aid  the 
caseworkers  in  processing  and  managing  their  individual  cases: 


—  A  "casenotes"  screen  is  provided  to  allow  the  caseworker  to 
record  all  activity  on  the  case. 

—  A  monthly  "aging  report"  lists  all  of  the  cases  assigned  to  a 
caseworker,  sorted  in  order  of  "last  update  date."   A 
caseworker  can  quickly  identify  cases  that  have  not  had  recent 
activity,  and  determine  whether  further  action  is  necessary. 

—  "Ticklers"  are  automatically  generated  by  the  system,  indicating 
to  the  caseworker  that  something  may  need  to  be  done  to  update 
the  case.   There  are  over  one  hundred  automatic  ticklers.   The 
caseworker  can  also  manually  create  a  tickler,  as  a  self- 
reminder. 

Caseworkers  are  located  in  one  of  five  regional  offices,  located  in 
Butte,  Billings,  Missoula,  Great  Falls,  and  Helena.   We  visited 
each  of  the  regional  offices  and  tested  casefiles  and  interviewed 
caseworkers.   We  identified  issues  relating  specifically  to  the 
handling  of  cases,  and  the  information  maintained  in  the  casefiles. 
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Case  Management 


The  five  regional  offices  have  inconsistent  policies  on  the  handling 
of  the  ticklers  and  the  monthly  aging  reports.   Consistent  statewide 
policy  regarding  the  use  of  these  system  tools  could  improve  the 
program's  case  management. 


Ticklers  Should  be 
Reviewed  Daily 


There  are  over  one  hundred  ticklers  available  on  the  system, 
covering  many  different  scenarios.   Certain  ticklers  receive  priority 
designation,  which  indicates  a  more  urgent  need  for  action.   When 
the  caseworkers  work  their  ticklers,  they  can  request  a  list  of 
priority  ticklers,  which  will  exclude  all  nonpriority  ticklers. 


We  reviewed  tickler  lists  for  51  caseworkers,  and  found  20 
caseworkers  had  over  18  pages  (approximately  6  ticklers  per  page) 
of  past  due  ticklers,  in  addition  to  the  current  ticklers.   Four  of  the 
caseworkers  had  over  99  pages  of  past  due  ticklers. 

Two  regions  require  caseworkers  to  review  and  clear  aH  ticklers 
daily.   Caseworkers  in  those  regions  believe  it  is  important  to  work 
all  the  ticklers  and  this  has  helped  them  be  more  efficient  in 
working  their  cases.   Ticklers  are  a  tool  developed  to  help  the 
caseworkers  perform  their  jobs  more  efficiently.   In  order  to  fully 
utilize  that  tool,  the  caseworkers  should  be  required,  through  a 
statewide  policy,  to  review  all  ticklers  daily. 


Aging  Report  not  used 
Consistently 


Two  regional  offices  require  the  caseworkers  to  "touch"  their  cases 
every  90  days  or  less  through  use  of  the  aging  report.   Those 
regions  have  a  consistently  higher  rate  of  collections  per 
caseworker,  collections  per  case,  and  total  cases  in  enforcement 
status.   Management  attributes  those  higher  rates,  at  least  in  part, 
to  the  aging  report  policy.   Other  regions  don't  fully  utilize  the 
report,  or  recommend  the  cases  be  "touched"  annually,  instead  of 
quarterly.   We  believe  the  department  should  consider  establishing 
statewide  policies  to  aid  the  regions  in  increasing  caseworker 
efficiency,  including  the  use  of  the  aging  report. 


Page  S-5 


Report  Summary 


Incomplete/Inaccurate 
Information  on  the  System 


We  performed  a  random  sample  of  open  child  support  cases,  and 
found  42  of  the  74  cases  tested  with  either  incomplete  or  inaccurate 
information  in  the  on-line  casefiles,  as  compared  to  supporting 
documentation.   This  information  may  be  used  in  determining  the 
support  required  by  the  absent  parent,  in  notifying  the  participants, 
and  in  locating  the  absent  parent.   Therefore,  the  information  on 
the  system  should  be  complete  and  accurate.   Centralizing  the 
intake  function  or  establishing  a  statewide  policy  on  required  input 
should  increase  consistency  of  input  and  decrease  the  risk  of 
inaccurate  information  input  on  the  system. 


Central  Office  Issues 


Introduction 


The  Administrative  Services  Bureau  of  the  CSED  office  is  located 
in  Helena.  Within  the  bureau  are  the  System  Policy  and  Training 
Unit  and  the  Technical  Accounting  and  Payment  Processing  Unit. 
Personnel  within  these  units  provide  support,  such  as  training, 
accounting/bookkeeping,  table  information  updates,  and  program 
enhancements,  which  benefit  all  caseworkers  throughout  the  state. 
We  identified  issues  related  to  these  centralized  functions. 


Table  Testing 


SEARCHS  utilizes  system  tables  which  contain  key  data  used  in 
other  processes,  such  as  numbers,  percentages,  rates,  codes,  limits, 
etc.  The  data  in  these  tables  is  used  in  calculating  child  support 
amounts,  and  is  input  based  on  federal  regulations,  as  well  as  state 
statutes.   We  determined  there  are  no  policies  or  standard  proce- 
dures regarding  table  maintenance.   In  addition,  we  found  three 
tables  where  the  information  contained  therein  was  inaccurate, 
based  on  current  guidelines.   The  information  on  these  tables  is 
used  in  the  calculation  of  disposable  income,  which  is  the  basis  for 
determining  the  amount  of  a  child  support  payment.   Information 
on  the  tables  should  be  reviewed  periodically  to  ensure  it  is  up-to- 
date  and  accurate. 
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Additional  Input  Edits 
Required 


Duplicate  Accounts 


Child  Emancipation 


Case  Activity  Date 


SEARCHS'  primary  method  of  insuring  only  correct  information  is 
input  to  the  system  is  through  application  validity  edits. 
Application  edits  are  designed  to  compare  input  data  to 
preestablished  limits  and  reasonableness  tests.   SEARCHS  edits 
include  alpha  and  numeric  checks  to  ensure  data  input  is 
reasonable.   We  reviewed  application  edits  to  determine  if  they 
provide  integrity  of  information  processed  by  SEARCHS,  and 
found  instances  where  additional  edits  could  further  enhance  the 
integrity  of  SEARCHS  data. 

System  edits  do  not  prevent  two  cases,  with  the  same  participants, 
from  being  open  as  current  accounts.   Since  this  could  result  in  the 
system  double-charging  the  absent  parent,  an  edit  should  be 
installed  which  only  allows  one  current  account  for  any  open  case. 

When  a  child  in  a  case  emancipates,  he/she  will  no  longer  be 
included  in  the  calculation  of  child  support  payments.   The  system 
automatically  calculates,  based  on  the  child's  birthdate,  when  the 
child  will  emancipate.   However,  the  system  will  not  prevent  the 
entry  of  a  birthdate  for  a  child  that  generates  an  emancipation  date 
less  than  the  date  of  input,  indicating  the  child  has  already 
emancipated. 

The  case  activity  date  is  a  date  field  updated  automatically 
whenever  the  case  status  changes.   Case  status  identifies  whether  a 
case  is  in  locate,  establishment,  enforcement,  etc.  This  activity 
date  is  used  to  demonstrate  how  long  a  case  stays  in  each  status 
and  is  used  for  documenting  compliance  with  federal  timelines. 
The  only  time  the  activity  date  should  be  updated  is  when  the  status 
of  the  case  is  changed.   However,  we  found  that  when  other 
changes  are  made  to  the  case,  that  do  not  affect  the  case  status,  the 
case  activity  date  is  automatically  updated. 


Use  of  State  Resources 


During  our  audit  we  identified  department  policies  and  procedures 
which  conflict  with  the  efficient  use  of  state  resources.   These 
policies  relate  to  warrants  written  to  the  custodial  or  non-custodial 
parent. 
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Warrants  Less  Than 
$10.00 


Department  policy  currently  delays  the  creation  of  warrants  for 
amounts  less  than  $10.00.   The  transactions  are  placed  in  a 
"suspense"  file  for  six  months,  unless  payment  is  specifically 
requested  by  the  payee.   After  the  suspension  period  has  expired, 
the  system  automatically  releases  the  amounts  for  payment. 
Warrants  are  written  and  automatically  sent  out  for  amounts  greater 
than  $1.00.   For  amounts  less  than  $1.00,  warrants  are  written, 
and  a  letter  is  included  with  the  warrant  explaining  the  suspense 
period  process. 


The  Department  of  Administration  (DOA)  has  adopted  rules  which 
limit  refunds  paid  to  $3.00  or  more.   DPHHS  should  develop  a 
policy,  regarding  refund  payments  to  the  absent  parent,  in  compli- 
ance with  state  policy  that  prevents  payment  of  amounts  less  than  a 
$3.00  minimum.    This  would  prevent  the  additional  expense 
incurred  in  the  creation  of  state-issued  warrants. 


Multiple  Warrants 


When  CSED  receives  a  payment  for  a  client  who  is  currently 
receiving  AFDC  benefits,  federal  regulations  require  the  first 
$50.00  of  the  payment  go  directly  to  the  custodial  parent.   The 
remaining  amount  will  be  used  to  offset  the  AFDC  grant  due  the 
client.   If  the  amount  received  exceeds  the  AFDC  grant,  the 
remaining  balance  will  be  considered  "in  excess"  and  will  be  paid 
directly  to  the  custodial  parent.   These  three  amounts  (the  $50.00 
disregard,  the  AFDC  grant,  and  the  "in  excess"  amount)  will  be 
sent  to  the  custodial  parent  as  three  separate  checks.   Since  these 
amounts  are  a  result  of  the  same  payment,  and  are  being  paid  to 
the  same  person,  we  believe  it  would  be  more  efficient  to  combine 
the  amounts  into  one  warrant  and  provide  a  breakdown  of  the 
amounts  in  the  warrant  stub. 


Contingency  Planning 


A  contingency  plan  has  not  been  developed  for  the  SEARCHS 
application.   The  department's  use  of  computers  is  critical  to  the 
operation  of  the  SEARCHS  program.   Loss  of  computer  use  would 
significantly  impact  department  operations. 


A  written,  detailed  plan  outlining  recovery  procedures  should  exist 
and  be  tested  to  ensure  feasibility  of  the  plan.   Maintaining  an 
adequate  contingency  plan  will  ensure  continued  data  processing 
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operations  and  the  department's  compliance  with  state  and  federal 
regulations. 
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Introduction 


This  is  an  audit  of  internal  controls  over  the  Department  of  Public 
Health  and  Human  Service's  computer-based  System  for  the 
Enforcement  And  Recovery  of  Child  Support  (SEARCHS)  applica- 
tion.  We  performed  an  electronic  data  processing  audit  of  this 
application.   We  selected  the  Department  of  Public  Health  and 
Human  Services  (DPHHS)  and  this  application  because  of  the 
significant  dollar  amounts  processed  and  the  widespread  use  of  the 
information  maintained  on  the  system.    In  addition,  this  audit 
provides  assistance  to  the  financial-compliance  audit  staff  of  the 
Legislative  Audit  Division  in  their  biennial  audit  of  the  DPHHS. 


The  Child  Support  Program  spent  approximately  $8.76  million  in 
total  operating  expenditures  in  fiscal  year  1994-95,  and  received 
$9.1  million  in  operating  revenue,  of  which  $6.2  million  was  from 
federal  sources.   Federal  funds  are  the  source  for  67  percent  of  the 
program's  operating  revenue. 


EDP  Audit  General 
Controls 


An  Electronic  Data  Processing  (EDP)  audit  consists  primarily  of  a 
review  of  internal  controls.   In  an  automated  environment  the 
procedures  for  reviewing  controls  are  different  from  those  used  in 
a  manual  environment.   However,  the  objective  of  ensuring  the 
reliability  of  controls  is  still  the  same.   EDP  auditing  entails 
performing  a  general  and  an  application  control  review.   The  gen- 
eral control  review  consists  of  an  examination  of  the  following 
types  of  controls: 


Organizational  -  apply  to  the  structuring  and  management  of  the 
data  processing  function.   Specific  types  of  organization  controls 
include  segregation  of  duties,  assignment  of  responsibilities,  rota- 
tion of  duties,  and  supervision. 

Procedural  -  include  operating  standards  and  procedures  which 
ensure  the  reliability  of  computer  processing  results  and  protect 
against  processing  errors. 

Hardware  and  Software  -  are  controls  within  the  operating  system 
software  and  hardware  which  monitor  and  report  system  error 
conditions. 
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System  Development  -  include  oversight  and  supervisory  controls 
imposed  on  development  projects.   Controls  include  feasibility 
studies,  development,  testing  and  implementation,  documentation, 
and  maintenance. 

Physical  Security  -  represent  physical  site  controls  including 
security  over  access  to  the  computer  facility,  protection  devices 
such  as  smoke  alarms  and  sprinkler  systems,  and  contingency 
prevention  and  recovery  plans. 

Electronic  Access  -  are  controls  which  allow  or  disallow  user 
access  to  electronically  stored  information  such  as  data  files  and 
application  programs. 


Conclusion:  General 
Controls  Provide  Controlled 
Application  Processing  for 
SEARCHS 


A  general  control  review  provides  information  regarding  the  ability 
to  control  EDP  applications  operating  in  the  audited  environment. 
During  our  audit  we  found  two  areas,  electronic  access  (discussed 
in  chapter  II)  and  contingency  planning  (discussed  in  chapter  IV), 
where  we  determined  there  is  need  for  improvement.    Overall,  we 
determined  the  department's  general  control  environment  provides 
for  controlled  application  processing. 


EDP  Audit  Application 
Controls 


Application  controls  are  specific  to  a  given  application  or  set  of 
programs  that  accomplish  a  specific  objective.   Application  controls 
consist  of  an  examination  of  the  following  controls  and  objectives. 


Input  -  Ensure  all  data  is  properly  encoded  to  machine  form  and 
that  all  entered  data  is  approved. 

Processing  -  Ensure  all  data  input  is  processed  as  intended. 

Output  -  Ensure  all  processed  data  is  reported  and  properly 
distributed  to  authorized  individuals. 
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Conclusion:   SEARCHS 
Application  Controls  Could 
Be  Improved 


During  our  review,  we  found  areas  where  input  and  output  controls 
could  be  improved.   These  concerns,  and  our  recommendations, 
are  discussed  in  Chapters  III  and  IV. 


A  review  of  the  application  documentation  and  audit  trail  was  also 
performed.  Applications  must  operate  within  the  general  controls 
environment  in  order  for  any  reliance  to  be  placed  on  them. 


Audit  Objectives 


The  objectives  of  our  EDP  audit  of  the  SEARCHS  application  were 
to  evaluate: 


1.  The  general  and  application  controls  applicable  to  SEARCHS 
in  order  to  assess  the  accuracy  and  reliability  of  data  main- 
tained and  processed  by  the  system. 

2.  The  effectiveness  of  DPHHS's  Child  Support  Enforcement 
Division's  program  procedures  applicable  to  case  manage- 
ment, enforcement,  and  reporting. 


Audit  Scope  and  Meth- 
odology 


The  audit  was  conducted  in  accordance  with  government  audit 
standards.   We  measured  the  department's  general  and  application 
controls  against  criteria  established  by  the  American  Institute  of 
Certified  Public  Accountants  (AICPA),  General  Accounting  Office 
(GAO),  federal  certification  requirements,  and  accepted  industry 
EDP  guidelines. 


We  reviewed  the  department's  general  controls  related  to  the  main- 
frame environment  which  processes  the  SEARCHS  application. 
We  interviewed  department  personnel  to  gain  an  understanding  of 
the  hardware  and  software  environment  specific  to  SEARCHS  at 
the  DPHHS.   We  also  reviewed  available  documentation  relevant 
to  the  SEARCHS  application. 

We  conducted  an  application  control  review  of  the  SEARCHS 
application,  as  it  operated  through  August  1995.   We  reviewed: 

1.  Input  controls,  such  as  input  authorization,  edits,  access 
controls,  and  error  correction  procedures. 

2.  Processing  controls,  including  reconciliation  procedures, 
processing  edits,  and  recalculation  of  various  formulas. 
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3.      Output  controls,  such  as  accuracy  and  validity  of  data  on 
system  generated  reports  and  report  distribution  procedures. 

We  determined  if  controls  over  data  are  effective  as  well  as 
adequate  to  ensure  the  accuracy  of  data  during  processing  phases. 
In  addition,  we  reviewed  the  department's  processes  and  proce- 
dures for  use  of  the  SEARCHS  application  in  its  case  management, 
case  enforcement  and  reporting.   Such  processes  may  impact  the 
efficiency  and  effectiveness  of  the  Child  Support  Enforcement 
program. 


Compliance 


We  determined  compliance  with  state  and  federal  laws  and  regula- 
tions applicable  to  the  SEARCHS  system.    Generally,  we  found  the 
department  to  be  in  compliance  with  federal  child  support  enforce- 
ment regulations,  as  well  as  state  statutes.   However,  as  described 
on  page  10,  we  were  unable  to  test  compliance  with  some  federal 
and  state  laws  and  regulations  because  the  contract  vendor  could 
not  provide  an  adequate  test  environment. 


Background 


The  Child  Support  Enforcement  Division  (CSED)  of  DPHHS  was 
established  to  aid  in  locating  absent  parents,  and  recovering  child 
support  from  those  parents.   The  federal  Family  Support  Act  of 
1988  mandated  that  all  states  have  federally-certified  automated 
child  support  enforcement  systems  by  September  30,  1995. 
Congress  recently  passed  legislation  which  extended  the  date  for 
federally-certified  automated  systems  to  September  30,  1997. 


The  state  of  Montana  began  planning  for  its  automated  system, 
SEARCHS,  in  February  1989.   As  a  result  of  a  competitive 
procurement,  the  department  selected  a  vendor  to  transfer  and 
implement  San  Francisco's  county-based  CASES  system.   The 
contract  between  the  state  of  Montana  and  the  vendor  received 
federal  approval  in  October  1991,  with  a  fixed  price  amount  of 
$5,295,901. 

SEARCHS  was  implemented  over  a  four  month  period  beginning 
in  March  1993  and  ending  in  June  1993.   In  September  1994,  the 
U.S.  Department  of  Health  and  Human  Services  (HHS)  granted 
conditional  certification  to  SEARCHS  and  noted  additional 
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enhancements/modifications  which  were  required  prior  to  granting 
full  certification.   The  certification  review  team  noted  Montana  is 
the  first  state  to  have  an  automated  child  support  enforcement 
system  certified  as  meeting  the  requirements  of  the  Family  Support 
Act  of  1988.   By  June  1993,  SEARCHS  supported  42,235  cases. 
CSED  expects  this  will  increase  to  58,139  cases  by  the  end  of  state 
fiscal  year  1997. 


Federal  certification  requirements  for  child  support  enforcement 
systems  are  established  by  the  Administration  for  Children  and 
Families  (ACF)  of  HHS.   The  ACF  established  these  requirements 
through  the  publication  of  regulation  45  CFR  07.   The  regulation 
governs  enhanced  funding  for  the  acquisition  and  operation  of 
comprehensive  statewide  child  support  enforcement  systems.   One 
primary  requirement  of  the  federal  regulations  relates  to  the 
interface  between  the  Aid  to  Families  with  Dependent  Children 
(AFDC)  program  and  the  child  support  enforcement  system. 

The  Montana  SEARCHS  system  meets  and  exceeds  federal  design 
requirements  for  the  operation  of  an  automated  child  support 
system.    SEARCHS  provides  information  for  case  management, 
enforcement  of  support  orders  and  reporting  to  document  compli- 
ance with  federal  regulations.   It  is  a  complex  and  comprehensive 
system.   SEARCHS  encompasses  all  child  support  enforcement 
services  in  the  state  and  supports  the  following  entities:   five 
regional  offices  (Billings,  Butte,  Great  Falls,  Missoula,  and  the 
interstate  regional  office  located  in  Helena);  the  Technical 
Accounting  and  Payment  Processing  Unit  in  Helena;  the  depart- 
ment's Office  of  the  Administrative  Law  Judge  in  Helena;  and 
central  administration  of  the  CSED  in  Helena. 

The  CSED  had  approximately  $28.9  million  of  total  child  support 
collections  in  fiscal  year  1994-95,  including  $8.6  million  in  federal 
reimbursements  for  AFDC  payments  made.   Following  is  a 
summary  of  the  basic  SEARCHS  operational  components. 
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Case  Initiation  Cases  are  initiated  through  several  methods: 


1.  Direct  application  from  the  custodial  parent  (non-AFDC). 
These  are  parents  not  receiving  direct  aid  from  the  welfare 
system,  but  who  require  services  for  the  collection  of  money 
for  child  support. 

2.  Referrals  from  Title  IV-A,  AFDC  program.   These  parents 
receive  aid  from  the  welfare  system  for  the  support  of  their 
dependant  children.   In  order  to  receive  AFDC  payments,  the 
parent  must  allow  their  case  to  be  referred  to  the  SEARCHS 
system  to  attempt  to  recoup  the  AFDC  payments  (or  a  portion 
thereof)  from  the  absent  parent. 

3.  Title  IV-E  (Foster  Care  program)  referrals,  to  help  recoup 
costs  incurred  by  the  foster  care  system. 

4.  Title  XIX  (Medicaid)  referrals,  to  ensure  the  child  is  covered 
by  the  absent  parent's  health  insurance  when  applicable. 

5.  Interstate  referrals,  to  aid  in  the  recovery  of  child  support 
payments  where  one  of  the  parents  lives  in  a  different  state. 

6.  Child  Welfare  System  (state  Foster  Care  program)  referrals, 
to  help  recoup  costs  incurred  by  the  foster  care  system  for 
children  placed  in  state  care. 

Cases  are  entered  on  the  system  either  through  manual  input  of 
application  information  or  electronic  transfer  of  data  from  referred 
cases.   Additional  manual  input  is  required  for  referrals. 


Locate  Once  the  case  is  initiated  and  entered  onto  the  system,  the  system 

electronically  interfaces  with  several  sources  to  obtain  and  verify 
location,  asset  and  other  information  on  the  noncustodial  parent  or 
custodial  parent.   The  interfaces  include: 

Department  of  Labor  and  Industry,  Unemployment  Insurance 
system  (BeARS),  Workers'  Compensation  System,  Job 
Service  program 

Department  of  Revenue,  Income  Tax  systems 

-      Federal  I.R.S. 
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Federal  Parent  Locate  Service  (FPLS) 

Department  of  Justice,  Driver's  License  and  Vehicle  Registra- 
tion systems 

Department  of  Corrections  (Institutions) 

Credit  Bureaus 

Military  systems 

Federal  Social  Security  Administration 

DPHHS,  The  Economic  Assistance  Management  System 

Several  of  these  interfaces  are  automatically  performed  by  the 
system  on  a  regular  basis  (daily,  weekly,  monthly)  in  order  to  get 
up-to-date  information  on  the  parents.   The  system  alerts  the 
caseworker  when  a  "hit"  is  made  on  the  case. 


Establishment 


Child  support  enforcement  regulations  require  several  criteria  be 
met  to  validate  the  identity  of  the  absent  parent  named  on  an 
application  for  child  support.   The  system  tracks,  monitors  and 
reports  on  the  status  of  paternity  establishment,  support  obligations, 
established  support  orders,  and  medical  support  services. 


Enforcement 


Once  paternity  has  been  established  and  the  absent  parent  located, 
the  case  moves  to  enforcement  status.   This  status  represents  the 
actual  collection  stage  for  child  support  enforcement  caseworkers. 

The  system  automatically  monitors  compliance  with  support  orders 
and  prompts  the  caseworker  to  initiate  enforcement  actions,  such  as 
income  withholding,  federal  and  state  tax  refund  offsets,  liens  and 
bonds,  Unemployment  Compensation  Intercept,  and  forwarding 
arrearage  information  to  credit  reporting  agencies.   It  also  supports 
the  enforcement  of  spousal  support,  and  monitors  compliance  with 
and  supports  the  enforcement  of  medical  insurance  provisions 
contained  within  support  orders. 

The  following  figure  documents  case  flow  from  case  initiation 
through  the  SEARCHS  application  to  support  enforcement. 
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Case  Management 


The  tools  available  to  the  caseworker  via  the  system  are  significant 
and  allow  for  effective  case  management. 


The  system  automatically  directs  cases  to  the  appropriate  case 
activity.   It  accepts  and  processes  case  updates  and  provides  infor- 
mation to  other  programs  on  a  timely  basis.   SEARCHS  updates 
and  maintains,  in  the  automated  case  record,  all  information,  facts, 
events,  and  transactions  necessary  to  describe  a  case  and  all  actions 
taken  in  a  case.   It  keeps  the  caseworker  informed  of  significant 
case  events,  monitors  case  activity,  provides  case  status 
information,  and  helps  to  ensure  timely  case  action  by  the 
caseworkers.   The  system  automatically  supports  the  review  and 
adjustment  of  support  obligations  and  allows  for  case  closure.   It 
also  provides  for  management  of  cases  where  one  of  the  parents  is 
residing  in  another  state. 


Financial  Management 


The  system  automatically  bills  cases  with  obligations,  processes  all 
payments  received,  and  supports  the  acceptance  and  disbursement 
of  payments  using  electronic  funds  technology.   In  addition  the 
system  performs  all  calculations  and  distributes  collections  in 
accordance  with  the  federal  child  support  program.    It  generates 
notices  to  current  and  former  AFDC  recipients  continuing  to 
receive  child  support  benefits  about  the  amount  of  support  collec- 
tions.  SEARCHS  automatically  generates  notices  to  the  AFDC 
agency  about  collections  for  AFDC  recipients. 


Reporting 


The  system  maintains  information  required  to  prepare  federal 
reports.   It  provides  an  automated  daily  on-line  report/worklist  to 
each  caseworker  to  assist  in  case  management  and  processing.   The 
system  generates  reports  required  to  ensure  and  maintain  the 
accuracy  of  data  and  to  summarize  accounting  activities.   In 
addition,  it  provides  management  reports  for  monitoring  and 
evaluating  employees,  and  office/unit  and  program  performance. 
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System  Maintenance/Use 


SEARCHS  operates  on  the  Department  of  Administration's  main- 
frame computer.    Effective  April  1993,  a  contract  vendor  assumed 
facilities  management  responsibility  for  the  system.    Under  this 
arrangement,  the  vendor  is  responsible  for  the  support  of  all 
SEARCHS  related  computer  processing  functions: 

Scheduled  production  jobs,  both  on-line  and  batch. 

Application  software  development,  maintenance,  testing  and 
integration. 

User  training  and  help  desk  services. 

Ad  hoc  inquiries,  reports  and  extracts. 

Data  base  file  and  library  maintenance. 

Backup,  restoration  and  reorganization. 

SEARCHS  software  and  security  administration. 


Scope  Limitation 


In  order  to  ensure  the  SEARCHS  application  is  in  compliance  with 
federal  and  state  laws,  CSED  produces  reports  which  supply 
statistical  information  regarding  caseloads,  case  activity,  case 
status,  etc.,  and  individual  case  information  to  the  federal  govern- 
ment, credit  bureaus,  division  management  and  caseworkers.   In 
our  initial  plan  for  the  audit  of  the  SEARCHS  application,  we 
planned  to  test  the  reports  to  ensure  the  information  contained  in 
the  reports  is  complete  and  accurate.   In  order  to  test  the  reports 
we  requested  access  to  the  test  system,  and  assurance  the  test 
system  mirrors  the  production  system. 

Personnel  in  charge  of  the  maintenance  of  the  system  could  not 
provide  us  a  window  of  time  in  which  to  perform  this  testing  on 
the  test  system.   They  stated  the  test  environment  is  so  dynamic 
that  they  could  not  provide  a  window  of  three  to  five  days  where 
the  test  system  would  mirror  the  production  system.   This  limited 
the  scope  of  our  testing. 

The  federal  government  and  division  management  rely  on  the 
system  reports  to  ensure  the  state  complies  with  federal  and  state 


Page  10 


Chapter  I  -  Introduction  and  Background 


regulations.   We  could  not  determine  the  accuracy  of  the  reports 
produced  by  the  system,  or  whether  the  method  by  which  the 
report  information  is  gathered  by  the  system  is  reasonable.   In 
1994  the  division  underwent  a  federal  review  which  concluded  the 
federal  reports  generated  from  information  provided  by  SEARCHS 
were  accurate.   We  were  not  able  to  confirm  the  results  of  that 
testing  for  our  audit  period.   The  department  recognizes  the 
seriousness  of  this  limitation  on  the  scope  of  our  testing  and  has 
agreed  to  provide  us  with  the  necessary  environment  for  our 
testing.   This  work  should  be  completed  by  March  1,  1996  and  the 
results  separately  communicated  to  the  department. 


Organization  of  Report  This  report  is  divided  into  four  chapters:   Chapter  I  contains  the 

introduction  and  background,  Chapter  II  discusses  the  electronic 
access  control  issues,  Chapter  III  discusses  application  control 
issues  which  are  applicable  to  the  various  regions,  and  Chapter  IV 
discusses  issues  related  to  central  operations. 
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Introduction  Access  controls  provide  electronic  safeguards  designed  to  ensure 

computer  system  resources  are  properly  used.   Logon  IDs  and 
passwords  control  electronic  access  to  DPHHS's  computer  applica- 
tions, computer  programs,  and  computer  data.   Federal  regulations 
require  the  state  to  have  policies  to  evaluate  SEARCHS  for  risk  on 
a  periodic  basis.   The  system  must  be  protected  against 
unauthorized  access  to  computer  resources  and  data  in  order  to 
reduce  erroneous  or  fraudulent  activities.   In  addition,  the  state  of 
Montana  Information  Technology  Advisory  Council  has  adopted 
guidelines  for  establishing  electronic  access  controls  for  all 
computer  system  platforms.   The  guidelines  are  included  in  the 
Department  of  Administration's  state  "Computing  Directions, 
Standards,  and  Guidelines"  manual. 

Proper  access  controls  assist  in  the  prevention  or  detection  of 
deliberate  or  accidental  errors  caused  by  improper  use  or  manipu- 
lation of  data  files,  unauthorized  or  incorrect  use  of  a  computer 
program,  and/or  improper  use  of  computer  resources.   The  depart- 
ment's security  officer  writes  rules  which  limit  access  to  specific 
areas  of  the  system.   Assigning  limited  access  based  on  job  require- 
ments facilitates  checks  and  balances  in  the  system.   This  approach 
prevents  users  from  inadvertently  or  willfully  executing  programs 
or  changing  data  unrelated  to  their  job. 

System  and  application  programmers  have  the  highest  degree  of 
technical  expertise  in  the  computer  processing  facility  and;  there- 
fore, play  an  important  role  in  maintaining  the  system.   However, 
managers  have  the  primary  responsibility  for  maintaining  adequate 
controls.   Without  adequate  controls,  computer  specialists  could 
alter  program  procedures  and  data  for  personal  gain.   We  identified 
several  areas  where  the  department  could  improve  its  access 
controls. 
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Access  to  Production 
Files  Should  be 
Restricted 


Access  to  electronic  files  stored  on  the  mainframe  is  protected  by 
an  application  control  package  called  Access  Control  Facility 
(ACF2).   Rules  are  written  which  allow  certain  users  to  access 
specific  data  and/or  programs  within  the  test  or  production 
systems.   In  addition,  the  SEARCHS  application  security  system 
further  restricts  access  to  specific  screens  within  the  system.   We 
reviewed  electronic  access  rights  given  for  the  SEARCHS 
programs  and  data  within  the  production  system.    We  found  full 
(read,  write,  allocate,  execute)  privileges  have  been  given  to 
several  contract  programmers  and  agency  personnel  via  ACF2.   In 
addition,  three  IDs  with  generic  "operator"  names  also  have  total 
write  access  to  the  production  files  and  programs.   Agency 
personnel  were  not  able  to  explain  the  reasoning  for  the  access 
given  to  most  of  these  users. 


Access  to  production  files  should  be  limited  to  those  authorized  to 
process  or  maintain  particular  systems  based  on  the  job  duties  of 
the  individual.   In  addition,  no  one  person  should  have  access  to 
write  information  to  both  programs  and  data.   Ideally,  write  access 
to  production  files  should  be  limited  to  the  person  performing  a 
particular  job,  and  only  for  the  time  period  needed  to  complete  the 
job.   A  person  with  unrestricted  access  could  modify  the  existing 
programs  and/or  data  without  authorization  and  potentially  manipu- 
late the  system. 

Department  personnel  indicated  programmers  have  write  access  to 
the  production  files  for  the  purpose  of  fixing  processing  errors. 
However,  the  department  should  examine  alternative  methods  for 
ensuring  appropriate  access  to  production  files.   If  production 
recovery  necessitates  access  by  the  programmers,  the  reason  for  the 
access  should  be  documented  and  the  access  should  be  limited  to 
specific  time  periods.   Currently,  all  write  access  to  the  production 
files  by  programmers  is  logged,  but  the  ACF2  log  reports  are  so 
voluminous  that  they  are  not  reviewed  by  department  personnel. 
Because  the  security  officer  does  not  perform  a  review  of  the  logs, 
the  logging  of  the  access  is  ineffective.   Existing  ACF2  rules  could 
be  reviewed  and  revised  to  reduce  the  size  of  the  ACF2  log 
reports.   In  addition  to  the  security  officer,  someone  who  is 
familiar  with  the  system  and  the  files  should  review  the  logs  to 
ensure  the  access  is  appropriate. 
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Recommendation  #1 

We  recommend  the  department: 

A.  Review  all  write  access  to  production  Files,  restrict  the 
access  to  only  those  individuals  needing  it  in  the 
performance  of  their  jobs,  and  document  the  reason 
for  any  write  access  to  production  files. 

B.  Ensure  the  logged  reports  are  reviewed  to  determine 
the  appropriateness  of  modifications  to  the  production 
files. 


System  Table  Access  SEARCHS  utilizes  system  tables  which  contain  key  data  used  in 

Should  be  Restricted  other  processes.   This  data  includes  such  things  as  federal  with- 

holding allowance  amounts,  state  withholding  allowances,  social 
security  tax  rates,  standard  of  living  adjustment  percentages,  etc. 
This  data  is  placed  in  tables  for  ease  of  maintenance  as  the  data 
changes.   Access  to  the  table  screens  allows  maintenance  of  these 
tables. 

Electronic  access  controls  over  system  tables  do  not  provide 
adequate  prevention  of  improper  changes  to  information.    We 
found  28  individuals  have  write  access  to  system  tables  which 
allows  them  to  make  changes  to  the  data.   Nine  of  the  twenty-eight 
individuals  are  CSED  employees  who  are  not  responsible  for 
maintaining  the  system  tables.   Seventeen  of  the  twenty-eight  are 
contract  employees  whose  duties  periodically  include  updating 
system  tables  upon  department  request.   The  remaining  two 
employees  are  primarily  responsible  for  table  maintenance; 
therefore,  we  do  not  question  their  ability  to  change  table  data. 

Industry  standards  and  federal  regulations  require  management  to 
implement  procedures  to  ensure  proper  data  results  are  provided  by 
an  application  system.   Effective  electronic  access  controls  over 
system  tables  should  prevent  SEARCHS  employees  from  changing 
table  information  either  intentionally  or  unintentionally. 
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Improperly  updated  table  information  could  result  in  inaccurate 
computation  of  child  support  obligations. 

Department  personnel  indicated  access  to  the  production  system  has 
not  been  revised  since  original  system  testing.   They  acknowledged 
users  may  have  been  assigned  access  during  system  development 
which  they  no  longer  require.   The  access  to  the  system  tables 
should  be  reviewed,  and  inappropriate  access  presently  granted  to 
individuals  should  be  revoked. 


Recommendation  #2 

We  recommend  the  department  review  user  access  to 
system  tables  and  remove  access  for  those  individuals  not 
requiring  it  in  the  performance  of  their  jobs. 


Caseworker  Access  to 
Accounting  Screens 
Should  be  Restricted 


When  a  new  child  support  case  is  created,  the  initial  accounting 
information  (support  order  amount,  payment  history,  etc.)  is 
entered  by  the  caseworkers.   The  caseworker  then  has  the  ability  to 
update  or  change  the  accounting  information  on  that  account,  but 
only  for  that  day.   After  that,  the  caseworkers  are  locked  out  of 
most  of  the  accounting  screens,  and  any  changes  or  additions  must 
be  requested  and  made  through  the  Technical  Accounting  and 
Payment  Processing  Unit  (TAPP). 


The  one  exception  to  this  is  the  Debt  Order  History  (DOH)  screen. 
Caseworkers  may  change  the  information  on  the  DOH  screen  at 
any  time,  and  the  change  does  not  affect  the  other  accounting 
screens.   This  often  results  in  different  information  on  the  DOH 
screen  from  information  on  the  rest  of  the  accounting  system.    We 
tested  some  active  child  support  cases,  and  found  in  several  of  the 
cases  the  DOH  screen  did  not  agree  with  other  accounting  screens. 


The  DOH  screen  is  used  to  print  the  Debt  Comp  History  report. 
The  Debt  Comp  History  report  is  a  comprehensive  summary  which 
details  the  amounts  owed  by  the  absent  parent,  the  amounts  paid 
throughout  the  life  of  the  case,  and  the  current  amount  owed.   The 
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report  is  distributed  to  the  CSED  clients  and  documents  the  legal 
obligation  of  the  absent  parent.   Therefore,  it  is  imperative  the 
information  on  the  report  be  accurate.   This  is  difficult  to  ensure, 
since  the  information  can  be  changed  by  the  caseworker  at  any 
time,  with  or  without  supporting  documentation. 

We  interviewed  several  department  personnel  and  found  a  common 
opinion  between  many  of  the  caseworkers,  TAPP  personnel,  and 
management.   The  common  opinion  was  that  the  accounting  system 
is  quite  complex,  and  the  caseworkers  do  not  have  the  expertise  to 
adequately  update/change  the  accounting  information.    In  order  to 
ensure  all  accounting  information  relating  to  a  case  is  accurate  and 
complete,  we  believe  the  department  should  either  restrict  access 
for  the  accounting  screens  to  only  those  individuals  trained  to 
perform  those  tasks  or  establish  other  controls  to  ensure  the  DOH 
screen  agrees  to  the  other  accounting  screens.   The  restricted  tasks 
would  include  account  setup,  changes  to  the  accounts,  and 
generation  of  Debt  Comp  History  reports. 


Recommendation  #3 

We  recommend  the  department  either  restrict  access  to  the 
accounting  screens  to  the  Technical  Accounting  and  Pay- 
ment Processing  Unit  personnel  or  establish  other  controls 
to  ensure  the  DOH  screen  agrees  to  other  accounting 
screens. 


Position  Codes  do  not 
Agree  with  Actual  Job 
Duties 


As  additional  protection  against  unauthorized  access  to  the 
SEARCHS  system  information,  there  is  additional  security  beyond 
the  ACF2  security  mentioned  in  the  prior  section.   This  security  is 
over  the  application  only,  and  allows  or  restricts  access  to 
particular  screens  and  fields  within  those  screens.   Rather  than 
creating  a  specific  access  matrix  for  each  individual  user,  agency 
personnel  identified  40  positions  within  the  department,  and,  for 
access  purposes,  individuals  are  assigned  to  one  of  those  40 
positions.   In  designing  the  system  access  matrix,  agency  personnel 
identified  21  screens  they  consider  critical,  and  restricted  (or 
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allowed)  access  to  those  screens  based  on  the  job  responsibilities 
assigned  to  each  position. 

We  selected  a  sample  of  51  users,  and  through  interview  and 
review  of  job  descriptions  determined  13  of  those  users  were 
assigned  position  codes  that  were  inconsistent  with  their  actual  job 
duties.   Improperly  assigned  position  codes  could  allow  employees 
access  to  data  and  processes  that  is  inappropriate  for  their  position. 
For  example,  a  screen  may  have  security  which  allows  only 
accounting  personnel  to  update  accounting  data,  while  all  others 
may  only  view  the  data.   If  the  position  code  for  "accounting 
personnel"  is  improperly  assigned  to  other  employees,  those 
employees  could  modify  the  accounting  data  without  proper  autho- 
rization or  training. 

Agency  personnel  indicated  the  access  may  have  been  set  up  during 
conversion  of  the  SEARCHS  system,  which  occurred  in  1993.    The 
assigned  access  has  not  been  reevaluated  since  that  time.   The 
department  should  reevaluate  the  assigned  position  codes  to  ensure 
the  access  allowed  aligns  with  the  individual's  job  duties. 


Recommendation  #4 

We  recommend  the  department  reevaluate  employee  posi- 
tion code  assignments  to  SEARCHS,  and  ensure  the 
assignments  and  access  allowed  are  proper. 
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Introduction  As  discussed  in  Chapter  I,  SEARCHS  is  a  complex  and  compre- 

hensive system.   It  provides  some  "tools"  to  aid  the  caseworkers  in 
processing  and  managing  their  individual  cases. 

A  "casenotes"  screen  is  provided  to  allow  the  caseworker  to 
record  all  activity  on  the  case.   The  system  automatically 
generates  some  casenotes,  and  the  caseworker  can  manually 
input  casenotes  that  are  not  generated  by  the  system. 

A  monthly  "aging  report"  is  issued  to  each  caseworker,  listing 
all  of  the  cases  assigned  to  the  caseworker,  sorted  in  order  of 
"last  update  date."   Information  on  the  report  includes  partici- 
pants in  the  case,  status  of  the  case,  and  the  date  the  case  was 
last  updated  ("touched")  by  the  caseworker.   The  caseworker 
can  quickly  identify  cases  that  have  not  had  recent  activity, 
and  determine  whether  further  action  is  necessary. 

"Ticklers"  are  automatically  generated  by  the  system,  indicat- 
ing to  the  caseworker  that  something  may  need  to  be  done  to 
update  the  case.   For  instance,  the  system  will  automatically 
notify  the  caseworker  when  a  child  is  about  to  turn  18 
(emancipation),  which  may  require  the  caseworker  to  change 
the  status  of  the  case.   Also,  if  more  money  is  received  from 
the  absent  parent  than  what  is  currently  required,  the  system 
will  notify  the  caseworker  that  action  needs  to  be  taken  to 
determine  whether  to  refund  the  money,  apply  it  to  arrears,  or 
apply  it  as  a  pre-paid  for  future  obligations.   There  are  over 
one  hundred  automatic  ticklers.   The  caseworker  can  also 
manually  create  a  tickler,  as  a  self-reminder. 

Caseworkers  who  work  on  the  individual  child  support  cases  are 
located  in  one  of  five  regional  offices  located  in  Butte,  Billings, 
Missoula,  Great  Falls,  and  Helena.   We  visited  each  of  the  regional 
offices  and  tested  casefiles  and  interviewed  caseworkers.   We 
identified  issues  relating  specifically  to  the  handling  of  cases,  and 
the  information  maintained  in  the  casefiles.   Those  issues  are 
discussed  in  the  following  sections. 
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Case  Management 


Each  region  has  established  policies  and  procedures  for  handling 
cases  and  using  the  system  tools.   The  regional  offices  have  incon- 
sistent policies  on  the  handling  of  the  ticklers  and  the  monthly 
aging  reports.   Three  regional  offices  encourage  the  caseworkers  to 
work  their  priority  ticklers  daily,  but  leave  it  up  to  the  individual 
caseworkers  whether  they  work  the  other  ticklers  or  not.   In  the 
other  two  regional  offices,  it  is  office  policy  to  review  and  clear  all 
ticklers  daily.   The  same  two  regions  require  the  aging  reports  be 
used  so  that  all  cases  are  "touched"  at  least  every  90  days,  while 
the  other  regions  suggest  the  cases  be  "touched"  annually. 
Consistent  statewide  policy  regarding  the  use  of  these  system  tools 
could  improve  the  program's  case  management  as  discussed  below. 


Ticklers  Should  be 
Reviewed  Daily 


As  noted  above,  there  are  over  one  hundred  ticklers  available  on 
the  system,  covering  many  different  scenarios.   Certain  ticklers 
receive  priority  designation,  which  indicates  a  more  urgent  need 
for  action.   When  the  caseworkers  work  their  ticklers,  they  can 
request  a  priority  list  which  will  exclude  all  nonpriority  ticklers. 


We  reviewed  tickler  lists  for  51  caseworkers  and  found  20  case- 
workers had  over  18  pages  (approximately  six  ticklers  per  page)  of 
past  due  ticklers,  in  addition  to  the  current  ticklers.   Four  of  the 
caseworkers  had  over  99  pages  of  past  due  ticklers.   When 
questioned  as  to  why  they  do  not  clear  their  ticklers  daily,  some 
caseworkers  stated  their  caseload  is  too  large,  and  they  do  not  have 
the  time  to  "catch  up"  on  their  ticklers.   Also,  some  caseworkers 
said  there  are  too  many  unnecessary  ticklers,  and  it  is  a  waste  of 
time  to  work  them  all. 

Caseworkers  required  to  review  and  clear  all  ticklers  daily  believe 
it  is  important  to  work  all  the  ticklers,  and  this  has  helped  them  be 
more  efficient  in  working  their  cases.   The  average  number  of 
cases  per  caseworker  is  fairly  constant  between  regions  (around 
450),  although  case  status  may  differ  significantly  (see  Figure  2). 
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Figure  2 


Percent  of  Cases  in  Selected  Statuses 


Enforcement 
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Ticklers  are  a  tool  developed  to  help  the  caseworkers  perform  their 
jobs  more  efficiently.   In  order  to  fully  utilize  that  tool,  the  case- 
workers should  be  required,  through  a  statewide  policy,  to  review 
all  ticklers  daily.   If  they  believe  some  of  the  ticklers  are 
unnecessary,  they  should  bring  that  to  the  attention  of  management 
who  should  consider  removing  unnecessary  ticklers. 


Recommendation  #5 

We  recommend  the  department: 

A.  Establish  statewide  policy  which  requires  the  daily 
review  and  reconciliation  of  ticklers  by  the  case- 
workers. 

B.  Review  the  current  tickler  list,  evaluate  the  usefulness 
of  existing  ticklers,  and  remove  unnecessary  ticklers. 
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Aging  Report  not  used 
Consistently 


The  regions  that  "touch"  their  cases  every  90  days  or  less  through 
use  of  the  aging  report  have  consistently  higher  rates  of  collections 
per  caseworker,  collections  per  case,  and  total  cases  in  enforcement 
status  (see  Figures  2  and  3).   Management  for  those  regions  attri- 
bute those  higher  rates,  at  least  in  part,  to  their  aging  report  policy. 


Figure  3 


Average  Collections  per  Caseworker  and  Case 
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Caseworkers  and  management  personnel  at  the  other  regions 
indicated  there  are  several  reasons  they  do  not  "touch"  all  cases 
every  90  days.   Some  said  their  caseload  is  too  high  and;  therefore, 
they  do  not  have  the  time  nor  resources  to  properly  handle  their 
cases  that  often.   Additionally,  they  stated  the  ticklers  (see 
discussion  on  page  19)  notify  them  of  case  activity  and  need  for 
action,  so  working  the  aging  report  is  not  necessary. 

During  our  testing  of  casefiles  at  the  regions,  we  found  one  case 
where  the  custodial  parent  was  receiving  AFDC  for  several 
months,  although  AFDC  support  could  have  been  denied  due  to 
noncooperation  with  child  support  services.   The  division  did  not 
make  the  recommendation  to  the  AFDC  agency  regarding 
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noncooperation  in  a  timely  manner.   In  another  case  the  absent 
parent  was  receiving  social  security  benefits,  as  identified  through 
the  SEARCHS  interface  with  SSI.   The  case  was  in  "locate"  status 
(unable  to  locate  the  absent  parent)  even  though  the  system  had 
identified  the  location  through  the  SSI  interface.   The  case  had  not 
been  reviewed  for  over  1 1  months.   If  it  had  been  reviewed  on  a 
regular  basis,  the  case  may  have  been  moved  to  "enforcement" 
status  and  the  custodial  parent  could  have  been  receiving  child 
support  for  those  months. 

The  department's  management  reports  indicate  areas  where 
particular  regions  perform  more  efficiently.   We  believe  the  depart- 
ment should  determine  the  reasons  for  the  efficiencies,  and 
consider  establishing  statewide  policies  to  aid  the  other  regions  in 
increasing  their  efficiency.   One  of  the  tools  designed  to  increase 
the  efficiency  of  the  caseworker  is  the  aging  report. 


Recommendation  #6 

We  recommend  the  department  establish  statewide  policies 
for  the  consistent  use  of  the  aging  reports  by  regional 
caseworkers. 


Incomplete/Inaccurate  We  performed  a  random  sample  of  open  child  support  cases.   For 

Information  on  the  each  sample  case,  we  compared  the  information  on  the  system  with 

System  supporting  documentation  in  the  case  files.   Individual  information 

we  tested  included  such  things  as  participant  names  and  addresses, 
dates  of  birth,  social  security  numbers,  support  order  amounts,  etc. 

We  found  42  of  the  74  cases  tested  with  either  incomplete  or 
inaccurate  information  in  the  on-line  casefiles  as  compared  to  the 
supporting  documentation.   According  to  agency  personnel,  in  17 
of  these  42  cases  information  was  excluded  because  the  caseworker 
determined  the  information  was  not  critical  to  the  processing  of  the 
case.   These  things  included  such  things  as  child's  race  and  place 
of  birth,  and  custodial  parent's  phone  number  in  interstate  cases. 
For  the  remaining  25  cases,  the  inaccurate  or  incomplete 
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information  may  be  necessary  in  determining  the  support  required 
by  the  absent  parent,  in  notifying  the  participants,  or  in  locating  the 
absent  parent.   Therefore,  the  information  on  the  system  should  be 
complete  and  accurate. 

Agency  personnel  indicated  the  reason  for  inaccurate  and  incom- 
plete information  may  be  that  during  conversion  to  the  new 
SEARCHS  system,  there  were  a  lot  of  people  entering  a  lot  of 
information  and  that  is  when  many  of  the  errors  occurred.   In 
addition,  input  is  performed  by  several  different  personnel  within 
the  agency.   Applications  are  sent  to  the  regional  offices  and  are 
input  by  the  "intake  workers"  there.   Each  intake  worker  may  have 
different  ideas  of  what  is  considered  "important",  and  may  include 
or  exclude  certain  information  from  the  system  based  on  those 
ideas.   The  department  should  have  some  method  of  quality  control 
to  insure  complete  and  accurate  information  passed  between 
agencies  and  applicants  is  loaded  onto  the  system.   The  department 
could  consider  requiring  all  new  case  applications  be  mailed  by  the 
applicant  to  a  central  location  for  initial  input,  or  the  department 
could  establish  a  statewide  policy  on  information  required  to  be 
input  for  each  case.    Centralizing  the  intake  function  or  establishing 
a  statewide  policy  on  required  input  should  increase  consistency  of 
input  and  decrease  the  risk  of  inaccurate  information  input  on  the 
system. 

In  order  to  ensure  the  information  in  the  present  cases  is  complete 
and  accurate,  the  department  should  make  review  of  the  informa- 
tion a  part  of  the  regular  review  of  the  cases.   This  could  be  done 
in  conjunction  with  the  use  of  the  aging  report,  discussed  on 
page  21. 
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Recommendation  #7 

We  recommend  the  department: 

A.  Require  all  present  on-line  cases  be  reviewed  and 
updated  with  correct  and  current  information. 

B.  Establish  procedures  to  ensure  complete  and  accurate 
information  is  input  for  all  new  cases. 
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Introduction 


The  Administrative  Services  Bureau  of  the  CSED  office  is  located 
in  Helena.   Within  the  bureau  are  the  System  Policy  and  Training 
Unit  and  the  TAAP  Unit.   Personnel  within  these  units  provide 
support  such  as  training,  accounting/bookkeeping,  table  information 
updates,  and  program  enhancements  which  benefit  all  caseworkers 
throughout  the  state.   We  identified  issues  related  to  these 
centralized  functions.   Those  issues  are  discussed  in  the  following 
sections. 


Table  Testing 


As  mentioned  on  page  14,  SEARCHS  utilizes  system  tables  which 
contain  key  data  used  in  other  processes,  such  as  numbers,  percent- 
ages, rates,  codes,  limits,  etc.   This  data  is  placed  in  tables  for 
ease  of  maintenance  as  the  data  changes.   The  data  in  these  tables 
is  used  in  calculating  child  support  amounts,  and  is  input  based  on 
federal  regulations,  as  well  as  state  statutes.   For  example,  a 
caseworker  enters  client  income  and  household  size,  and 
SEARCHS  compares  this  information  to  state  and  federal  standards 
included  in  the  tables  and  automatically  determines  the  authorized 
child  support  obligation. 


We  reviewed  the  information  in  the  tables  and  found  three  different 
tables  where  the  information  contained  therein  was  inaccurate  based 
on  current  guidelines.   Two  of  the  tables  contained  three  different 
errors,  and  the  remaining  table  had  one  error.   The  information  on 
these  tables  is  used  in  the  calculation  of  disposable  income,  which 
is  the  basis  for  determining  the  amount  of  a  child  support  payment. 
Depending  on  the  case,  disposable  income  could  have  been 
calculated  either  too  high  or  too  low.   As  a  result,  child  support 
payments  due  from  absent  parents  may  have  been  calculated 
incorrectly.   The  data  on  the  tables  should  be  reviewed  periodically 
to  ensure  it  is  up-to-date  and  accurate. 

Agency  personnel  indicated  changes  to  the  tables  are  performed 
only  as  requested,  and  there  are  no  policies  or  standard  procedures 
regarding  table  maintenance.   Information  on  the  tables  is  not 
periodically  reviewed  to  ensure  it  is  up-to-date.   In  addition,  as 
noted  on  page  14,  access  to  change  the  tables  is  not  controlled,  so 
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unauthorized  changes  could  be  made  by  several  individuals.   This 
increases  the  need  for  periodic  review  of  the  tables. 


RecommcMfcifinn  #8 

We  recommend  the  department  establish  policies  and 
procedures  for  periodic  review  of  tables  to  ensure  the 
information  is  current  and  accurate. 


Additional  Input  Edits 
Required 


SEARCHS'  primary  method  of  ensuring  only  correct  information  is 
input  to  the  system  is  through  application  validity  edits.   Applica- 
tion edits  are  designed  to  compare  input  data  to  preestablished 
limits  and  reasonableness  tests.   SEARCHS  edits  include  alpha  and 
numeric  checks  to  ensure  data  input  is  reasonable.   We  reviewed 
application  edits  to  determine  if  edits  provide  integrity  of  informa- 
tion processed  by  SEARCHS.   Overall,  we  determined  existing 
edits  operate  as  intended.   However,  as  discussed  in  the  following 
sections,  the  department  should  create  additional  edits  to  further 
enhance  the  integrity  of  SEARCHS  data. 


Duplicate  Accounts 


Different  types  of  accounts  can  be  set  up  for  a  case,  depending  on 
the  particular  circumstances  in  the  case.   For  instance,  a  current 
case  may  be  designated  as  AFDC  with  payments  due  monthly,  or 
non-AFDC  with  payments  due  weekly.   In  addition,  there  can  be 
one  or  more  "arrears"  accounts.   Only  one  current  account  can 
officially  be  open  at  a  time  for  each  case.   However,  the  system 
edits  do  not  prevent  two  cases  with  the  same  participants  from 
being  open  as  current  accounts.   Since  this  could  result  in  the 
system  double-charging  the  absent  parent,  an  edit  should  be 
installed  which  only  allows  one  current  account  for  any  open  case. 
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Child  Emancipation 


When  a  child  in  a  case  emancipates  (for  example,  turns  18),  he/she 
will  no  longer  be  included  in  the  calculation  of  child  support 
payments.   The  system  automatically  calculates,  based  on  the 
child's  birthdate,  when  the  child  will  emancipate.    However,  the 
system  will  not  prevent  the  entry  of  a  birthdate  for  a  child  that 
generates  an  emancipation  date  less  than  the  date  of  input,  indicat- 
ing the  child  has  already  emancipated.   We  identified  one  case 
where  the  child's  birthdate  was  incorrectly  entered,  showing  a  30- 
year  old  child,  but  the  system  allowed  it. 


Case  Activity  Date 


The  case  activity  date  is  a  date  field  updated  automatically  when- 
ever the  case  status  changes.   Case  status  identifies  whether  a  case 
is  in  locate,  establishment,  enforcement,  etc.   This  activity  date  is 
used  to  demonstrate  how  long  a  case  stays  in  each  status  and  is 
used  for  documenting  compliance  with  federal  timelines.   The  only 
time  the  activity  date  should  be  updated  is  when  the  status  of  the 
case  is  changed.   However,  we  found  that  when  other  changes  are 
made  to  the  case,  that  do  not  affect  the  case  status,  the  case  activity 
date  is  automatically  updated. 


Summary 


Based  on  our  testing,  we  determined  overall  application  edits 
function  effectively  to  maintain  the  integrity  of  information 
produced  by  SEARCHS.   However,  as  noted  above,  the  depart- 
ment could  create  additional  edits  to  improve  the  integrity  of  data 
on  the  system. 


Many  of  the  edits  in  place  on  the  SEARCHS  system  refer  to  tables 
which  have  valid  values  for  the  fields  in  question.   Occasionally, 
those  tables  are  changed  to  reflect  changes  in  policy,  regulations, 
etc.   We  found  the  on-line  help  screen,  which  aids  the  user  in 
determining  what  values  are  valid  for  a  particular  field,  is  not 
updated  consistently  to  reflect  the  changes.   Agency  personnel 
indicated  it  is  their  informal  policy  to  update  the  help  screen 
whenever  any  changes  are  made,  but  the  policy  is  not  always 
followed.   Formal  documentation  of  the  policy,  and  distribution  of 
the  policy  to  staff  responsible  for  the  changes,  could  help  ensure 
the  changes  are  reflected  in  the  help  screens. 
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Recommendation  #9 

We  recommend  the  department: 

A.  Establish  additional  edits,  as  determined  necessary,  to 
prevent  improper  information  from  being  input  onto 
the  system. 

B.  Establish  and  distribute  formal  policies  which  require 
the  updating  of  on-line  help  screens  when  changes  are 
made  to  production  tables. 


Use  of  State  Resources 


During  our  audit  we  identified  department  policies  and  procedures 
which  conflict  with  the  efficient  use  of  state  resources.   These 
policies  relate  to  warrants  written  to  the  custodial  or  non-custodial 
parent  and  are  discussed  in  the  following  sections. 


Warrants  Less  Than 
$10.00 


Federal  regulation  requires  the  department  to  pay  the  custodial 
parent  any  amounts  received  for  support.   Department  policy 
currently  delays  the  creation  of  warrants  for  amounts  less  than  ten 
dollars.   The  transaction  is  placed  in  a  suspense  file  for  six  months. 
If,  during  that  six  month  period,  additional  money  becomes  due  to 
the  payee  which  brings  the  amount  to  over  $10.00,  the  transactions 
will  be  combined  and  released  for  payment.    After  the  suspension 
period  has  expired,  the  system  automatically  releases  the  amounts 
for  payment.   Warrants  are  written  and  automatically  sent  out  for 
amounts  greater  than  $1.00.   For  amounts  less  than  $1.00, 
warrants  are  written,  and  a  letter  is  included  with  the  warrant 
explaining  the  suspense  period  process. 


Section  17-8-203,  MCA,  grants  the  Department  of  Administration 
(DOA)  authorization  to  establish  a  minimum  amount  paid  on 
refunds  due  from  state  agencies.   DOA  has  adopted  rules  which 
limit  refunds  paid  to  $3.00  or  more.   The  suspense  period  is 
effective  in  preventing  the  immediate  payment  of  insignificant 
amounts.   However,  the  department  should  develop  a  policy, 
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regarding  refund  payments  to  the  absent  parent,  in  compliance  with 
state  policy  that  prevents  payment  of  amounts  less  than  a  $3.00 
minimum.    This  would  prevent  the  additional  expense  incurred  in 
the  creation  of  state-issued  warrants. 


Multiple  Warrants  When  CSED  receives  a  payment  for  a  client  that  is  currently 

receiving  AFDC  benefits,  federal  regulations  require  the  first 
$50.00  of  the  payment  go  directly  to  the  custodial  parent.   The 
remaining  amount  will  be  used  to  offset  the  AFDC  grant  due  the 
client.   If  the  amount  received  exceeds  the  AFDC  grant,  the 
remaining  balance  will  be  considered  "in  excess"  and  will  be  paid 
directly  to  the  custodial  parent.   These  three  amounts  (the  $50.00 
disregard,  the  AFDC  grant,  and  the  "in  excess"  amount)  will  be 
sent  to  the  custodial  parent  as  three  separate  checks.   Since  these 
amounts  are  a  result  of  the  same  payment,  and  are  being  paid  to 
the  same  person,  we  believe  it  would  be  more  efficient  to  combine 
the  amounts  into  one  warrant  and  provide  a  breakdown  of  the 
amounts  in  the  warrant  stub.   This  would  require  coordination 
between  the  CSED  and  the  department's  Family  Assistance 
Division  which  generates  two  of  the  three  payments. 


Recommendation  #10 

We  recommend  the  department: 


A.  Adopt  policies  which  prevent  the  creation  of  warrants 
for  insignificant  amounts. 

B.  Develop  a  policy,  and  program  the  SEARCHS  appli- 
cation, to  combine  warrants  where  feasible. 
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Duplicate  Receipts  Pro- 
cessing 


During  our  testing  of  the  receipts  process,  it  came  to  our  attention 
that  an  IRS  tape,  listing  the  names  and  dollar  amounts  of  income 
tax  offsets  for  several  absent  parents,  was  loaded  onto  the  system 
twice.   As  a  result,  the  system  generated  duplicate  warrants  to 
custodial  parents.   By  the  time  the  mistake  was  discovered,  many 
of  the  warrants  had  already  been  cashed  and  as  a  result,  an 
accounts  receivable  account  needed  to  be  set  up  for  the  client.   The 
accounts  receivable  charges  cannot  be  deducted  from  the  current 
support,  so  some  of  the  money  may  never  be  recouped.   The  out- 
standing accounts  receivable  balance  is  $13,285. 


Since  this  incident,  the  department  has  implemented  controls  to 
reduce  the  risk  of  this  recurring.   Therefore,  this  is  reported  for 
disclosure  purposes  only  and  we  make  no  recommendation  at  this 
time.   However,  we  intend  to  follow-up  on  the  collection  status  of 
the  accounts  receivable  during  our  biennial  financial-compliance 
audit. 


Contingency  Planning 


Contingency  planning  is  a  basic  element  of  safeguarding  computer 
systems  and  information  resources.   Contingency  planning  involves 
formulating  a  plan  for  recovery  of  operations  in  the  event  of  a 
disruption  of  normal  activities.   A  contingency  plan  should  be 
comprehensive  and  periodically  tested  to  facilitate  an  adequate 
recovery  process.   The  contingency  plan  should  include  consider- 
ation of  physical  facilities,  personnel,  operating  instructions, 
supplies  and  forms,  application  programs,  documentation,  system 
software,  and  data.   It  should  start  with  an  inventory  of  equipment 
and  programs  and  be  regularly  updated  to  reflect  changes  in 
computer  equipment  and  programs. 


Federal  regulations  require  the  state  to  have  procedures  in  place  for 
retrieval,  maintenance,  and  control  of  the  application  software  and 
program  data.   Also,  system  hardware,  software,  documentation, 
and  communications  must  be  protected  and  back-up  must  be 
available. 

Since  the  SEARCHS  system  is  run  on  the  state's  mainframe 
computer,  files  and  programs  are  backed  up  regularly  by  the 
DOA's  Information  Services  Division,  and  provisions  have  been 
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made  for  the  replacement/repair  of  the  mainframe  equipment. 
However,  the  department  is  responsible  for  ensuring  a  contingency 
plan  is  in  place  for  all  equipment  and  supplies  located  at  the 
DPHHS  offices. 

We  interviewed  department  personnel  to  determine  if  they  have  a 
contingency  plan  which  contains  the  minimum  contingency  guide- 
lines as  stated  in  section  1-0240.00,  Montana  Operations  Manual 
(MOM).   They  indicated  a  contingency  plan  was  never  developed 
for  SEARCHS.   The  department  should  develop  a  plan  which 
includes,  but  is  not  limited  to: 

1.  Documented  backup  recovery  procedures. 

2.  Provisions  for  backup  hardware. 

3.  Documented  procedures  for  manual  operation  in  the  event  of 
a  disaster. 

4.  A  detailed  definition  of  responsibilities  for  each  organizational 
unit. 

5.  Identifying  potential  disasters  and  their  impact. 

The  department's  use  of  computers  is  critical  to  the  operation  of 
the  SEARCHS  program.    Loss  of  computer  use  would  significantly 
impact  department  operations. 

A  written,  detailed  plan  outlining  recovery  procedures  should  exist 
and  be  tested  to  ensure  feasibility  of  the  plan.   We  recognize 
thorough  contingency  planning  is  an  intensive  and  on-going 
process.   However,  maintaining  an  adequate  contingency  plan  will 
ensure  continued  data  processing  operations  and  the  department's 
compliance  with  section  1-0240.00,  MOM  and  federal  regulations. 
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Recommendation  #11 

We  recommend  the  department: 

A.  Establish  a  formal  contingency  plan  in  compliance 
with  section  1-0240.00,  MOM  and  federal  regulations. 

B.  Periodically  test  the  contingency  plan. 


Page  32 


Agency  Response 


Page  33 


MARC  BACICOT 
GOVERNOR 


DEPARTMENT  OF 
SOCIAL  AND  REHABILITATION  SERVICES 


PETER  S.  BLOUKE.  PhD 
DIRECTOR 


STATE  OF  MONTANA 


P.O.  BOX  4210 
HELENA.  MONTANA  59604-4210 


Date: 


January    30,     1996 


To : 


From: 


Mary  Bryson,  Deputy  Legislative  Auditor 
Operations  and  EDP  Audit 

yps> 

MiKe  Billings,  Administrator 
Operations  and  Technology  Division 


Subject:   DPHHS  Responses  to  SEARCHS  EDP  Audit 

Attached  are  DPHHS  responses  to  recommendations  made  in 
the  EDP  Audit  Report  for  SEARCHS. 

We  appreciate  the  effort  that  has  gone  into  your  examin- 
ation of  the  functioning  of  SEARCHS.  Your  recommendations 
will  be  of  value  to  us  in  insuring  the  on-going  integrity 
of  the  system. 

Please  contact  me  if  you  have  questions. 
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Recommendation  #1 

A.  The  department  agrees  that  access  to  production  files  should 
be  restricted  to  only  those  individuals  needing  access  in  the 
performance  of  their  jobs.  Currently  the  contractor,  BDM, 
utilizes  a  single  user  number  that  is  only  activated  between 
the  hours  of  5:00  AM  to  7:00  AM  and  12:00  PM  to  1:00  PM  to 
restrict  changing  of  information  in  the  data  base. 
Programmers  must  obtain  the  password  for  this  user  number  and 
log  the  reason  for  its  use  in  a  notebook.  Access  to 
production  (daily  or  monthly  transaction  files)  for  data 
changes  could  be  restricted  to  this  same  user  number. 

B.  The  department  agrees  that  the  logged  reports  should  be 
reviewed  on  a  regular  basis.  ACF2  logs  every  time  a 
programmer  accesses  the  production  files,  including  viewing  of 
the  data.  Since  programmers  review  the  data  frequently  the 
logs  are  extensive  and  of  little  use.  If  the  ability  to 
change  data  in  the  productions  files  was  restricted  as 
discussed  above,  the  ACF2  logs  for  that  single  user  number 
would  be  limited  to  actual  data  changes.  Reviewing  of  the 
ACF2  log  for  just  this  user  number  would  then  be  feasible.  In 
addition,  this  ACF2  log  would  provide  a  double  check  of  the 
contractor's  log  documenting  use  of  the  restricted  user 
number. 


Recommendation  #2 

The  department  agrees  that  access  to  the  system  tables  should 
be  reviewed  and  limited  to  only  those  individuals  assigned  the 
task  of  table  maintenance.  The  department  has  identified  two 
individuals  within  the  Systems,  Policy  and  Training  Unit,  the 
Fiscal  Officer,  and  select  contracted  staff  who  are 
responsible  for  table  maintenance.  Access  to  the  system 
tables  will  be  restricted  to  these  individuals  by  fiscal  year 
end. 

Recommendation  #3 

The  department  concurs  that  the  Debt  Order  History  Screen 
should  agree  with  the  information  on  the  accounting  system. 
The  department  will  establish  appropriate  controls  to  ensure 
the  DOH  screen  agrees  to  other  accounting  screens.  The 
department  estimates  this  can  be  accomplished  by  fiscal  year 
end. 


Recommendation  #4 

The  department  agrees  that  employee  position  code  assignments 
for  SEARCHS  should  be  evaluated  and  updated.  Job  duties  and 
responsibilities  continue  to  change  as  the  division  adjusts  to 
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the  automation  that  SEARCHS  provides.  Original  expectations 
of  access  needs  have  changed  for  a  number  of  positions  and 
need  to  be  updated.  The  department  will  review  and  update 
this  list  before  fiscal  year  end. 

Recommendation  #5 

A.  The  department  has  implemented  this  recommendation.  A 
statewide  policy  requiring  daily  review  and  reconciliation  of 
ticklers  has  been  adopted  by  the  department.  A  policy 
memorandum  (Management  Memo  96-01)  has  been  issued  to  all 
staff . 

B.  The  department  agrees  to  conduct  a  review  of  the  current 
tickler  list,  and  has  initiated  this  review  by  requesting 
caseworker  input.  A  policy  memorandum  (Management  Memo  96-01) 
instructs  caseworkers  to  review  the  current  tickler  list, 
evaluate  the  usefulness  of  existing  ticklers,  and  remove 
unnecessary  ticklers.  The  staff  has  been  instructed  to  submit 
recommendations  concerning  possible  issues  of  incorrect  or 
unnecessary  ticklers  for  further  management  review. 

Recommendation  #6 

The  department  agrees  that  the  Caseload  Report  and  the  SEARCHS 
tickler  system  currently  offer  the  best  methods  of  effectively 
managing  a  caseload.  Furthermore,  "dovetailing"  these  two 
management  tools  together  will  enhance  the  ability  to  achieve 
regional  performance  and  collection  goals.  A  policy 
memorandum  (Management  Memo  96-01)  has  been  issued  to  all 
staff  requiring  mandatory  use  of  the  aging  list  by 
caseworkers.  The  policy  memorandum  asserts  that  each  case  be 
"touched"  at  least  once  every  90  days . "Touching"  a  case  is 
defined  as;  reviewing  and,  if  appropriate,  taking  action  to 
ensure  federal  and  state  compliance.  When  reviewing  cases, 
caseworkers  have  been  formally  instructed,  via  the  policy 
memorandum  to  pay  particular  attention  to  the  possible  locate, 
paternity,  establishment,  enforcement,  and/or  medical  services 
required.  After  review,  the  written  policy  requires  an  update 
to  the  "Last  Reviewed  Date"  field  found  on  the  CAS  screen. 


Recommendation  #7 

A.  The  department  strongly  disagrees  with  this  recommendation.  To 
review  and  update  44,000  cases  would  be  time  prohibitive, 
costly  and  unproductive.  Child  support  agencies  are  moving 
toward  "results  oriented"  performance  criteria  rather  than 
"process  oriented"  criteria.  The  last  full  blown  federal 
audit  of  the  CSE  program  was  passed  ,  as  was  the  last  internal 
audit.  Page  4  of  this  EDP  report  states,  "Generally,  we  found 
the  department  to  be  in  compliance  with  federal  child  support 
enforcement  regulations,  as  well  as  state  statutes."  The 
department  admits  that  total  content  of  the  supporting 
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documentation  was  not  loaded  onto  the  automated  system, 
however,  the  information  not  loaded  did  not  have  an  effect  on 
the  outcome  of  the  case.  Many  other  checks  and  balances  are 
already  in  place  to  reduce  the  likelihood  of  error.  These 
include  internal  and  external  audits,  supervisor  reviews  of 
case  work,  supervisor  approval  of  income  withholding  orders 
and  case  closures,  system  edits  and  due  process  requirements. 

B.  The  department  agrees  that  prospectively,  all  supporting 
documentation  on  new  child  support  referrals  will  be  loaded  on 
to  the  SEARCHS  automated  system.  Special  attention  will  be 
given  to  complete  and  accurate  information.  This  has  been 
designated  as  CSED  policy,  and  included  in  Management  Memo  96- 
01. 


Recommendation  #8 

The  department  concurs .  As  described  in  the  response  to 
recommendation  number  four  (#4) ,  the  department  has  developed 
a  list  of  the  individuals  responsible  for  the  maintenance  of 
SEARCHS  tables.  That  list  will  be  updated  to  include  the 
target  dates  for  review  and  updating  of  the  tables.  For  those 
tables  that  require  updating  on  an  as  needed  basis  a  regular 
schedule  of  maintenance  will  be  developed.  In  addition  the 
department  will  develop  an  agreement  with  the  contractor 
regarding  the  tables  that  are  its  responsibility.  The 
agreement  will  identify  the  individual  responsible  for  each 
table's  maintenance  and  the  target  dates  by  which  it  should  be 
completed. 

Recommendation  #9 

A.  The  department  agrees  some  additional  edits  are  necessary  on 
SEARCHS.  The  child  emancipation  tickler  is  supposed  to  give 
the  caseworker  a  tickler  3  0  days  before  the  18th  birthday. 
However,  emancipation  depends  on  several  circumstances  and  the 
eighteenth  birthday  is  not  always  considered  emancipation. 
Case  activities  have  been  made  a  top  priority  for  the  contract 
programmers . 

B.  The  department  agrees  that  on-line  help  screens  are  an 
integral  part  of  the  SEARCHS  system.  These  help  screens  are 
sometimes  the  only  documentation  available  to  workers.  The 
department  will  assign  the  updating  of  the  on-line  help  screen 
to  a  position  in  the  Systems,  Policy  and  Training  Unit.  Due 
to  the  extensive  number  of  help  screens  it  will  be  necessary 
for  the  department  to  spread  this  task  over  many  months .  A 
schedule  of  help  screens  with  the  expected  completion  date 
will  be  developed. 

Recommendation  #10 
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A.  The  department  disagrees  with  this  recommendation  as  it 
violates  federal  regulations  under  which  the  program  operates. 
The  department  believes  the  current  policy  of  delaying 
warrants  in  amounts  less  than  $10.00  adequately  addresses  the 
issue  of  efficient  use  of  state  resources  while  maintaining 
compliance  with  federal  regulations  governing  the  program. 
Federal  regulations  regarding  the  distribution  of  child 
support  collection  require  the  department  to  process  and 
distribute  payments  within  15  days  of  receipt  (45  CFR  302.32) . 
Neither  the  department  nor  the  federal  regional  OCSE  were  able 
to  find  an  interpretation  that  would  prevent  payments  of 
amounts  less  than  $3.00.  State  policy  cannot  preempt  federal 
law. 

B.  The  department  agrees  with  combining  warrants  where  feasible. 
Steps  to  combine  warrants  have  been  taken  under  the 
departments  Welfare  Reform  program.  The  $50  disregard  and  the 
AFDC  grant  amount  will  be  combined  into  one  check  for  those 
individuals  that  participate  in  the  Welfare  Reform  Pathways 
and  Community  Service  Programs.  For  those  individuals  in  the 
Job  Supplement  Program  the  in- excess  amount  will  be  passed  to 
the  AFDC  computer  system  (TEAMS)  so  the  custodial  parent  will 
receive  the  warrant  from  that  system.  The  Welfare  Reform 
Program  starts  in  eight  pilot  counties  in  February  1996  and 
will  be  implemented  statewide  by  February  1997. 

Recommendation  #11 

The  completion  of  a  disaster  recovery  plan,  as  called  for  in  the 
SEARCHS  development  request  for  proposals,  has  been  postponed 
pending  receipt  of  the  Department  of  Administration  Information 
Services  Division  plan  which  has  not  yet  been  finalized.  The 
anticipated  completion  date  of  the  SEARCHS  plan  is  May  31,  1996. 
Testing  of  the  plan  will  be  performed  on  a  periodic  basis. 
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